System and method to associate a private user identity with a public user identity

ABSTRACT

The inventive system includes a host, a network including a security gateway, and a public application. Established are an access session between the network and the host and an application session between the public application and the network. An application session record is created for the application session, and includes the user&#39;s public user identity used to access the public application, the user&#39;s private user identity used to access the network, a host identity, and an application session time. To determine the private user identity for the application session, the security gateway sends a query with the host identity and the application session time. These are compared with the host identity and access session time in an access session record. If they match, then the private user identity in the access session record is returned, and it is stored as the private user identity in the application session record.

CROSS-REFERENCE TO RELATED APPLICATIONS

The present application is a continuation of co-pending U.S. patentapplication entitled “System and Method to Associate a Private UserIdentity with a Public User Identity”, Ser. No. 13/153,385, filed onJun. 3, 2011; which is a continuation of U.S. patent application Ser.No. 12/771,491, filed on Apr. 30, 2010, now U.S. Pat. No. 7,979,585,issued on Jul. 12, 2011; which is a continuation of U.S. patentapplication Ser. No. 11/582,613, filed on Oct. 17, 2006, now U.S. Pat.No. 7,716,378, issued on May 11, 2010.

BACKGROUND OF THE INVENTION

1. Field

This invention relates generally to data networking, and morespecifically, to a system and method to associate a public user identitywith a private user identity during an application session.

2. Related Art

The secure data network of a company is a critical component forday-to-day functioning of company business activities. Company employeesaccess the secure data network for communication within the company andwith the outside world. Company information, oftentimes proprietary orconfidential, is exchanged during the communication.

Typically, an employee gains access to the company's secure data networkby means of a network logon procedure using a private user identity,such as a user name “Robert P. Williamson” or an employee number“NGO1-60410”. Subsequent information exchange using the company's officeapplications, such as email, file transfer or document control istraceable based on the private user identity through network event logs.

Since the late 1990's, we have been witnessing the phenomenal risingpopularity of public communication services, such as email and InstantMessaging offered by Yahoo™, America Online™ (AOL), or Google™,conferencing and collaboration services offered by Webex™ or Centra™, orpeer-to-peer services for a variety of file sharing. Generally, a publiccommunication service allows a user to exchange information throughmessaging, text chat or document exchange using a public user identity,such as “butterdragon”, “fingernail1984”, or “peterrabbit”.

However, in a company setting, when an employee connects to a publiccommunication service with a public user identity over the company'ssecure data network, the information exchange is not easily traceable ifat all since the public user identity is not tied to the private useridentity.

In one example, a company's information technology (IT) departmentnotices that an employee Victor has been using the company's emailsystem to send out proprietary documents, violating the company'ssecurity policy. After issuing a warning to Victor, the IT departmentfinds no further violations. Unfortunately, they are not aware of thefact that Victor has continued this activity using Yahoo™ email with apublic user identity “PiratesOfCaribbean@Yahoo.com”.

In another example, two weeks before a major trade show, a companyimplements a security measure to monitor communication activities ofemployees of director level and above to ensure confidentiality ofcompetitive information. This security measure, covering company email,phone conversation and voice messaging, nevertheless proves to be afailure as sensitive information leaks out to a business reporter anywayprior to the trade show. The source of the leak may never be confirmed,but the business reporter privately discloses that he gets theinformation from an anonymous employee of the company using AOL InstantMessaging™ with screen name “opensecret2006”.

The above discussion illustrates the need for a solution to associate apublic user identity to a private user identity.

BRIEF SUMMARY OF THE INVENTION

A system and method for associating a private user identity with apublic user identity is disclosed. The system includes a host, a networkwhich includes a security gateway, and a public application residingexternally to the network. An access session is established between thenetwork and the host. An application session is established between thepublic application and the network via the security gateway, and anapplication session record is created for it. The application sessionrecord includes the user's public user identity, used to access thepublic application, and the user's private user identity, used foraccessing the network through the host. It further includes a hostidentity, and an application session time. To determine the private useridentity for the application session, the security gateway queries anidentity server, on which the access session record resides. The hostidentities in the application and access session records are thencompared, as well as the access session time with the applicationsession time. If they match, then the private user identity in theaccess session record is returned to the security gateway, which storesit as the private user identity in the application session record.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE FIGURES

FIG. 1 a illustrates a secure network.

FIG. 1 b illustrates an access session and an application session.

FIG. 1 c illustrates an access session record and an application sessionrecord.

FIG. 2 illustrates a process to generate an application session record.

FIG. 3 illustrates a process to recognize an application session.

FIG. 4 a illustrates a process to determine a public user identity ofapplication session.

FIG. 4 b illustrates a data packet in an AIM log-on packet.

FIG. 5 illustrates a process to determine a private user identity.

DETAILED DESCRIPTION OF THE INVENTION

FIG. 1 a illustrates a secure network.

A secure network 160 includes a host 130. User 120 uses host 130 toaccess a public application 180 hosted in application server 190.Application server 190 is outside of secure network 160. The networktraffic between host 130 and application server 190 passes throughsecurity gateway 150.

Host 130 is a computing device with network access capabilities. In oneembodiment, host 130 is a workstation, a desktop personal computer or alaptop personal computer. In one embodiment, host 130 is a Personal DataAssistant (PDA), a smartphone, or a cellular phone.

In one embodiment, secure network 160 is an Internet Protocol (IP)network. In one embodiment, secure network 160 is a corporate datanetwork or a regional corporate data network. In one embodiment, securenetwork 160 is an Internet service provider network. In one embodiment,secure network 160 is a residential data network. In one embodiment,secure network 160 includes a wired network such as Ethernet. In oneembodiment, secure network 160 includes a wireless network such as aWiFi network.

Public application 180 provides a service that allows user 120 tocommunicate with other users in a real-time fashion. In one embodiment,the service includes text chat. In one embodiment, the service includesa voice call or a video call. In one embodiment, the service includes anetwork game. In one embodiment, the service includes exchanging adocument, such as sending or receiving a text document, a powerpointpresentation, an excel spreadsheet, an image file, a music file or avideo clip.

In one example, public application 180 provides America Online InstantMessenger™ service. In one example, public application 180 providesYahoo Instant Messenger™ voice service. In one embodiment, publicapplication 180 provides a file sharing service such as Kazaa™ filesharing service. In one embodiment, public application 180 provides anetwork game service such as Microsoft™ Network Game service.

Security gateway 150 is situated at the edge of secure network 160.Security gateway 150 connects secure network 160 to public application180. Security gateway 150 receives network traffic from secure network160 and transmits the network traffic to application server 190.Likewise, security gateway 150 receives network traffic from applicationserver 190 and transmits the network traffic to secure network 160.

In one embodiment, security gateway 150 includes the function of acorporate Wide Area Network (WAN) gateway. In one embodiment, securitygateway 150 includes the function of a residential broadband gateway. Inone embodiment, security gateway 150 includes the function of a WANgateway for an Internet service provider.

FIG. 1 b illustrates an access session and an application session.

User 120 uses host 130 to access secure network 160 during an accesssession 162.

Host 130 has a host identity 134. Host 130 uses host identity 134 toconnect to secure network 160. In one embodiment, host identity 134includes an IP address. In one embodiment, host identity 134 includes aMedia Access Control (MAC) address.

Within secure network 160, user 120 has a private user identity 124. Inone embodiment, private user identity 124 is an employee number or anemployee name. In one embodiment, private user identity 124 is anInternet service subscription identity. In one embodiment, accesssession 162 is established after a successful network user log-inprocedure, such as an employee network log-in, for secure network 160using private user identity 124. Private user identity 124 is associatedwith host identity 134.

User 120 uses host 130 to access public application 180 in anapplication session 182. User 120 uses a public user identity 127 duringapplication session 182. In one embodiment, public application 180prompts user 120 to log-in before establishing application session 182.During the application user log-in procedure, user 120 provides topublic application 180 public user identity 127. In another embodiment,public application 180 selects a public user identity 127 for user 120for application session 182. In one embodiment, public user identity 127is set up through a user registration process or a service subscriptionprocess. Network traffic in application session 182 passes throughsecurity gateway 150.

FIG. 1 c illustrates an access session record and an application sessionrecord.

Access session record 164 records information about access session 162.The information includes private user identity 124, host identity 134and access session time 166. In one embodiment, access session time 166is the starting time when access session 162 is established. In oneembodiment, access session time 166 includes the starting time and theending time when user 120 finishes access session 162.

Application session record 184 records information about applicationsession 182. The information includes private user identity 124, publicuser identity 127, and application session time 186. In one embodiment,the information further includes host identity 134. In one embodiment,application session time 186 includes the starting time when applicationsession 182 is established. In one embodiment, application session time186 includes a time stamp during application session 182. In oneembodiment, application session time 186 includes a time stamp whensecurity gateway 150 recognizes application session 182.

FIG. 2 illustrates a process to generate an application session record.

The process of generating application session record 184 includesmultiple steps.

In step 201, security gateway 150 recognizes an application session.

In step 202, security gateway 150 determines a public user identity ofthe application session.

In step 203, security gateway 150 determines a private user identityusing information about the application session.

FIGS. 3-5 illustrates steps 201-203 respectively.

FIG. 3 illustrates a process to recognize an application session.

Security gateway 150 inspects network traffic between host 130 andapplication server 190 to recognize application session 182 for publicapplication 180.

In one embodiment, security gateway 150 inspects data packet 339 betweenhost 130 and application server 190 for the recognition of applicationsession 182.

Security gateway 150 includes an application identifier 355 for publicapplication 180. Application identifier 355 includes information forrecognizing application session 182. In one embodiment, applicationidentifier 355 includes a transport layer information, such asTransmission Control Protocol (TCP) or User Diagram Protocol (UDP); andat least one transport port number, such as a TCP port number or a UDPport number. In one embodiment, application identifier 355 includesapplication layer information, such as one or more data filters whereina data filter specifies a value and a position of the value in a datapacket. In one example, a data filter is [byte 0 with value “Ox52”]. Inone example, a data filter is [byte 4-7 with ASCII value of “ADEH”].

Security gateway 150 matches data packet 339 against applicationidentifier 355.

In one embodiment, application identifier 355 includes transportprotocol type of TCP and a destination TCP port number of 5190, the TCPport number used by AIM protocol. In this embodiment, data packet 339 isa TCP packet from host 130 to application server 190. Security gateway150 matches data packet 339 against application identifier 355 anddetermines that public application 180 provides AIM service.

Security gateway 150 creates application session record 184. Securitygateway 150 extracted the source IP address from the IP header of datapacket 339, and stores the source IP address as host identity 134. Inone embodiment, data packet 339 includes link layer information, such asa source MAC address; security gateway 150 extracts and stores thesource MAC address as host identity 134.

In one embodiment, security gateway 150 connects to a clock 359. Clock359 indicates the current time of day. Security gateway 150 stores thetime of day indicated by clock 359 in application session time 186.

FIG. 4 a illustrates a process to determine a public user identity ofapplication session 182.

The method for determining public user identity 127 is typicallyspecific to public application 180. In one embodiment, data packet 339is an application packet. For example, public application 180 providesAIM service; data packet 339 is an AIM packet.

An AIM packet includes multiple fields, for example

Command start field is a 1-byte data field starting at byte offset 0having a fixed hexadecimal value “Ox02”;

Channel ID field is a 1-byte data field starting at byte offset 1;

Sequence number field is a 2-byte integer starting at byte offset 2;

Data field length field is a 2-byte data field starting at byte offset4;

Family field is a 2-byte data field starting at byte offset 6; and

Subtype field is a 2-byte data field starting at byte offset 8.

An AIM log-on packet is a AIM packet with family field having a fixedhexadecimal value of “OxOO Oxl?” and subtype field having a fixedhexadecimal value of “OxOO Ox06”.

AIM log-on packet further includes buddy name length field, a I-byteinteger starting at byte offset 19, and a variable length buddy namefield starting at byte offset 20. Buddy name length field indicates thelength in bytes of buddy name field.

Security gateway 150 matches data packet 339 to determine if data packet339 is an AIM log-on packet. In one embodiment, data packet 339 is anAIM log-on packet 400 illustrated in FIG. 4 b. Security gateway 150extracts buddy name length field 405. Security gateway 150 furthersextracts buddy name field 407. In this embodiment, buddy name lengthfield 405 is integer “13” and buddy name field 407 is “JohnSmith1984”.Security gateway 150 stores “JohnSmith1984” as public user identity 124in application session record 184.

In one embodiment, data packet 339 is not an AIM log-on packet. Securitygateway 150 inspects another data packet from host 130.

FIG. 5 illustrates a process to determine a private user identity.

Secure network 160 includes an identity server 570. Identity server 570includes access session record 164 of access session 162 during whichuser 120 accesses application session 182.

Security gateway 150 queries identity server 570. Security gateway 150sends host identity 134 and application session time 186 to identityserver 570.

Identity server 570 receives host identity 134 and application sessiontime 186. Identity server 570 matches host identity 134 and applicationsession time 186 against access session record 164. Identity server 570determines that host identity 134 matches host identity of accesssession record 164. Identity server 570 further determines thatapplication session time 186 matches access session time 166 of accesssession record 164 as application session time 186 is between thestarting time and the ending time of access session record 164. Identityserver 570 sends private user identity 124 of access session record 164to security gateway 150 as a response to the query.

Security gateway 150 receives private user identity 124 from identityserver 570, and stores private user identity 124 in application sessionrecord 184.

In one embodiment, security gateway 150 stores public user identity 127in application session record 184 after recognizing a log-on approvalindication for the public user identity 127 from public application 180.

In one embodiment, security gateway 150 queries identity server 570immediately after determining public user identity 127. In oneembodiment, security gateway 150 queries identity server 570 afterapplication session 182 ends.

In one embodiment, security gateway 150 queries identity server 570 bysending a plurality of host identities in a bulk request; and receives aplurality of private user identities in a bulk response.

In one embodiment, application session record 184 includes additionaluser information associated with private user identity 124, such ascubicle or office number, cubicle or office location, telephone number,email address, mail-drop location, department name/identity, or managername.

In one embodiment, security gateway 150 obtains the additional userinformation from identity server 570. In one embodiment, securitygateway 150 obtains the additional user information by querying adifferent server, such as a corporate directory server, by using theprivate user identity 124 received from identity server 570.

In one embodiment, security gateway 150 generates a security reportbased on application session record 184. In one embodiment, securitygateway 150 generates a security report based on a pre-defined privateuser identity or a list of pre-defined private user identities. In oneembodiment, security gateway 150 generates a security report based on apre-defined schedule or when requested by an operator. In oneembodiment, security gateway 150 generates a security report based oncorporate security policy.

In one embodiment, public application 180 provides file transfer serviceusing File Transfer Protocol (FTP) protocol or a proprietary protocol.In one embodiment, public application 180 provides email service usingSimple Mail Transfer Protocol (SMTP), Internet Message Access Protocol(IMAP) or Post Office Protocol version 3 (POP3) protocol.

Foregoing described embodiments of the invention are provided asillustrations and descriptions. They are not intended to limit theinvention to precise form described. In particular, it is contemplatedthat functional implementation of invention described herein may beimplemented equivalently in hardware, software, firmware, and/or otheravailable functional components or building blocks, and that networksmay be wired, wireless, or a combination of wired and wireless. Othervariations and embodiments are possible in light of above teachings, andit is thus intended that the scope of invention not be limited by thisDetailed Description, but rather by Claims following.

1. A method for associating a user identity used for accessing anetwork, comprising: (a) recognizing an application session between thenetwork and an application via a security gateway, wherein therecognizing comprises: (a1) identifying a pattern of a data packettransmitted between the network and the application; and (a2) matchingthe pattern with an application identifier for the application; and (b)creating an application session record for the application session,wherein the application session record comprises an application sessiontime and a user identity for using the application session via a hosthaving a host identity, wherein the creating comprises: (b1) sending aquery to an identity server, wherein the query comprises the applicationsession time and the host identity; (b2) receiving a response from theidentity server to the query, wherein the response comprises a seconduser identity; and (b3) storing the second user identity as the useridentity for using the application session in the application sessionrecord.
 2. The method of claim 1, wherein the identity server comprisesan access session record for an access session between the host and thesecurity gateway, wherein the access session record comprises an accesssession time, wherein the receiving (b2) comprises: (b2i) comparing bythe identity server the access session time with the application sessiontime.
 3. The method of claim 1, wherein the recognizing (a) and thestoring (b3) further comprises: (a3) identifying a second pattern of thedata packet transmitted between the network and the application; and(b3i) storing the second pattern in the application session record. 4.The method of claim 3, wherein the second pattern comprises anapplication user identity.
 5. The method of claim 3, wherein the secondpattern comprises a piece of information comprised in a data packettransmitting a company document file between the network and theapplication.
 6. The method of claim 1, wherein the application comprisesat least one of: a messaging application; a file transfer application;an email application; a conferencing application; a collaborationapplication; a peer-to-peer application; a voice application; a videocall application document exchange application; or a file sharingapplication.
 7. The method of claim 1, wherein the user identitycomprises at least one of: a user name; an employee name; an employeenumber; a telephone number; a smartphone number; an email address; amail-drop location; an office number; a cubicle number; a cubicle oroffice location; or a manager name.
 8. The method of claim 1, whereinthe host identity comprises at least one of: an IP address; a MACaddress; or a computing device identity used to access the network.
 9. Asystem, comprising: a security gateway comprising a processor and amemory containing instructions which, when executed by the processor,cause the processor to perform a method, comprising: (a) recognizing anapplication session between a network and an application via thesecurity gateway, wherein the recognizing comprises: (a1) identifying apattern of a data packet transmitted between the network and theapplication; and (a2) matching the pattern with an applicationidentifier for the application; and (b) creating an application sessionrecord for the application session, wherein the application sessionrecord comprises an application session time and a user identity forusing the application session via a host having a host identity, whereinthe creating comprises: (b1) sending a query to an identity server,wherein the query comprises the application session time and the hostidentity; (b2) receiving a response from the identity server to thequery, wherein the response comprises a second user identity; and (b3)storing the second user identity as the user identity for using theapplication session in the application session record.
 10. The system ofclaim 9, wherein the system further comprises the identity server,wherein the identity server comprises an access session record for anaccess session between the host and the security gateway, wherein theaccess session record comprises an access session time, wherein theidentity server compares the access session time with the applicationsession time in response to receiving the query.
 11. The system of claim9, wherein the recognizing (a) and the storing (b3) further comprises:(a3) identifying a second pattern of the data packet transmitted betweenthe network and the application; and (b3i) storing the second pattern inthe application session record.
 12. The system of claim 11, wherein thesecond pattern comprises an application user identity.
 13. The system ofclaim 11, wherein the second pattern comprises a piece of informationcomprised in a data packet transmitting a company document file betweenthe network and the application.
 14. The system of claim 9, wherein theapplication comprises at least one of: a messaging application; a filetransfer application; an email application; a conferencing application;a collaboration application; a peer-to-peer application; a voiceapplication; a video call application document exchange application; ora file sharing application.
 15. The system of claim 9, wherein the useridentity comprises at least one of: a user name; an employee name; anemployee number; a telephone number; a smartphone number; an emailaddress; a mail-drop location; an office number; a cubicle number; acubicle or office location; or a manager name.
 16. The system of claim9, wherein the host identity comprises at least one of: an IP address; aMAC address; or a computing device identity used to access the network.17. A method for associating a user identity used for accessing anetwork, comprising: (a) recognizing an application session between thenetwork and an application via a security gateway; (b) retrieving anapplication data field from a data packet transmitted over theapplication session; (c) creating an application session record for theapplication session, wherein the application session record comprises:the application data field; an application session time; and a useridentity for using the application session via a host having a hostidentity, wherein the creating comprises: (b1) sending a query to anidentity server, wherein the query comprises the application sessiontime and the host identity; (b2) receiving a response from the identityserver to the query, wherein the response comprises a second useridentity; and (b3) storing the second user identity as the user identityfor using the application session in the application session record. 18.The method of claim 17, wherein the recognizing (a) comprises: (a1)identifying a pattern of the data packet transmitted between the networkand the application; and (a2) matching the pattern with an applicationidentifier for the application.
 19. The method of claim 18, wherein theretrieving (b) comprises: (b1) identifying a second pattern of the datapacket transmitted between the network and the application; and (b2)storing the second pattern in the application session record as theapplication data field.
 20. The method of claim 17, wherein the useridentity comprises at least one of: a user name; an employee name; anemployee number; a telephone number; a smartphone number; an emailaddress; a mail-drop location; an office number; a cubicle number; acubicle or office location; or a manager name.
 21. The method of claim17, wherein the host identity comprises at least one of: an IP address;a MAC address; or a computing device identity used to access thenetwork.
 22. The method of claim 17, wherein the application data fieldcomprises at least one of: a public user identity; an email identity; ascreen name; a buddy name; a messaging identity; an application command;a family field; a subtype field, a sequence number field; or a piece ofinformation about a company document.
 23. The method of claim 17,wherein the application provides at least one of the following services:a real-time communication service; an instant messaging service; amessaging or email service; a voice service; a video service; a gamingservice; a document exchange service; or a file sharing service.
 24. Asystem, comprising: a security gateway comprising a processor and amemory containing instructions which, when executed by the processor,cause the processor to perform a method, comprising: (a) recognizing anapplication session between the network and an application via securitygateway; (b) retrieving an application data field from a data packettransmitted over the application session; (c) creating an applicationsession record for the application session, wherein the applicationsession record comprises: the application data field; an applicationsession time; and a user identity for using the application session viaa host having a host identity, wherein the creating comprises: (b1)sending a query to an identity server, wherein the query comprises theapplication session time and the host identity; (b2) receiving aresponse from the identity server to the query, wherein the responsecomprises a second user identity; and (b3) storing the second useridentity as the user identity for using the application session in theapplication session record.
 25. The system of claim 24, wherein therecognizing (a) comprises: (a1) identifying a pattern of the data packettransmitted between the network and the application; and (a2) matchingthe pattern with an application identifier for the application.
 26. Thesystem of claim 25, wherein the retrieving (b) comprises: (b1)identifying a second pattern of the data packet transmitted between thenetwork and the application; and (b2) storing the second pattern in theapplication session record as the application data field.
 27. The systemof claim 24, wherein the user identity comprises at least one of: a username; an employee name; an employee number; a telephone number; asmartphone number; an email address; a mail-drop location; an officenumber; a cubicle number; a cubicle or office location; or a managername.
 28. The system of claim 24, wherein the host identity comprises atleast one of: an IP address; a MAC address; or a computing deviceidentity used to access the network.
 29. The system of claim 24, whereinthe application data field comprises at least one of: a public useridentity; an email identity; a screen name; a buddy name; a messagingidentity; an application command; a family field; a subtype field, asequence number field; or a piece of information about a companydocument.
 30. The system of claim 24, wherein the application providesat least one of the following services: a real-time communicationservice; an instant messaging service; a messaging or email service; avoice service; a video service; a gaming service; a document exchangeservice; or a file sharing service.